QOS seeing dscp 3 packets in default class when a class map in the policy map should match them

Richard Bradfield · ‎02-09-2018

I have ISR 4331 doing policy map out of gi0/0/1 interface

when I do a sh policy-map int gi0/0/1

see relevant part below

the Route-out class should match all CS6 packets but seeing some in Default class

the Interactivehigh-out class should match all cos3 prec 3 and dscp cs3 but seeing some in default class

why is this?

        Class-map: Route-out (match-all)
          209 packets, 15466 bytes
          30 second offered rate 0000 bps, drop rate 0000 bps
          Match: dscp cs6 (48)
          Match: protocol eigrp
          Queueing
          queue limit 64 packets
          (queue depth/total drops/no-buffer drops) 0/0/0
          (pkts output/bytes output) 0/0
          bandwidth 2% (3900 kbps)

        Class-map: Interactivehigh-out (match-any)
          22147 packets, 6345734 bytes
          30 second offered rate 41000 bps, drop rate 0000 bps
          Match: dscp cs3 (24)
          Match: ip precedence 3
          Match: cos 3
          Queueing
          queue limit 203 packets
          (queue depth/total drops/no-buffer drops) 0/0/0
          (pkts output/bytes output) 22147/6345734
          bandwidth 25% (48750 kbps)

        Class-map: class-default (match-any)
          379973 packets, 416764318 bytes
          30 second offered rate 1393000 bps, drop rate 0000 bps
          Match: any
          Queueing
          queue limit 256 packets
          (queue depth/total drops/no-buffer drops) 0/0/0
          (pkts output/bytes output) 379955/416756830
          shape (average) cir 195000000, bc 1950000, be 0
          target shape rate 195000000

            Exp-weight-constant: 4 (1/16)
            Mean queue depth: 0 packets
            dscp       Transmitted         Random drop      Tail drop          Minimum        Maximum     Mark
                    pkts/bytes            pkts/bytes       pkts/bytes          thresh         thresh     prob

            default   324873/339535312       0/0              0/0                 64           256 1/10
            3           54947/77209296        0/0              0/0                 64           128 1/10
            4               2/252             0/0              0/0                 64           128 1/10
            cs6          133/11970           0/0              0/0                112           128 1/10

chrihussey · ‎02-10-2018

Hello, this may provide an explanation (along with the supporting link):

IP Routing
By default, Cisco IOS software (in accordance with RFC 791 and RFC 2474) marks Interior Gateway Protocol (IGP) traffic such as Routing Information Protocol (RIP/RIPv2), Open Shortest Path First (OSPF), and Enhanced Interior Gateway Routing Protocol (EIGRP) to DSCP CS6. However, Cisco IOS software also has an internal mechanism for granting internal priority to important control datagrams as they are processed within the router. This mechanism is called PAK_PRIORITY.

As datagrams are processed though the router and down to the interfaces, they are internally encapsulated with a small packet header, referred to as the PAKTYPE structure. Within the fields of this internal header there is a PAK_PRIORITY flag that indicates the relative importance of control packets to the internal processing systems of the router. PAK_PRIORITY designation is a critical internal Cisco IOS software operation and, as such, is not administratively configurable in any way.

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND/QoS-SRND-Book/QoSIntro.html

Hope this helps

Richard Bradfield · ‎02-10-2018

Ok thanks for that info about the routing protocols, but that does not
explain why I am seeing dscp (cos) 3 packets matched in the default class
when one of my classes matches those markings

chrihussey · ‎02-10-2018

Sorry, I missed that.

I could be wrong but for the routing protocol it indicates CS6. Why not the same for DSCP CS3 (or IP Precedence 3)? Shouldn't it say CS3? (011000).

Could there be DSCP 3 packets (000011) passing through the router? I'm also not sure how it would treat AF3X packets. If it is indeed DSCP 3 (011000) in the default output, would the AF3X packets fall into this category? They wouldn't match the class-map.

If possible a sniffer trace may help identify what is going on.

Regards